Skip to content
Get packs

Guide · Agent skill

How to use the Configuring a Certificate Authority with OpenSSL agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the configuring-certificate-authority-with-openssl agent skill, which teaches an AI agent to build a small two-tier private certificate authority: an offline Root CA and an issuing Intermediate CA. It is aimed at engineers setting up internal PKI in a lab or staging environment, students learning how X.509 chains work, and security reviewers documenting a CA hierarchy. By the end you will know how to install the skill, ask for the right work in plain language, and what safety limits to keep in mind.

Configuring a Certificate Authority with OpenSSLmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder.
  2. 2Install Python dependencies. Make sure Python 3.8 or newer is available, then install the cryptography library with pip.
  3. 3Set up a lab environment. Use a test or staging machine and a disposable directory, since the scripts write private keys to disk.
  4. 4Ask for the Root CA. Request a self-signed Root CA, and confirm the agent explains the key size and validity it chooses.
  5. 5Ask for the Intermediate CA. Request an Intermediate CA signed by the Root, with a path length constraint.
  6. 6Issue and revoke test certificates. Ask for a server or client certificate from the Intermediate, then revoke it and generate a CRL to confirm it appears.
  7. 7Verify against the checklist. Check that the chain validates from leaf to Intermediate to Root and that policies and revocation data are present.

What is an agent skill, and what does this one do?

An agent skill is a folder of instructions, reference notes, templates and optional scripts that an AI agent such as Claude can load when a task matches the skill's description. This one is licensed under Apache-2.0 and is designed for cybersecurity cryptography work.

When the skill is active, the agent follows its guidance to create a Root CA with a self-signed certificate, create an Intermediate CA signed by the Root CA, issue server and client certificates from the Intermediate CA, configure Certificate Revocation Lists (CRLs), and set certificate policies and constraints. It also covers OCSP responder configuration and the certificate extensions involved, such as basicConstraints, keyUsage and crlDistributionPoints.

Install the skill in Claude

You can install the skill in either of two ways. For a personal setup, download the ZIP from this page and unzip it into ~/.claude/skills/. To scope it to one project, unzip it into that project's .claude/skills/ folder instead.

If you use the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into the project's .claude/skills/ folder
  • Claude apps: upload the ZIP under Settings → Capabilities → Skills

Check what you need before you start

The skill expects Python 3.8 or newer and the Python cryptography library. Install the library with pip. The skill name and docs mention OpenSSL, but the bundled scripts use the Python library to generate keys and certificates, so you do not need to drive the OpenSSL command line yourself.

The skill runs scripts and does not use the network, according to its listing. Use a test or lab environment and make sure you have authorization for any testing you do.

  • Python 3.8 or newer
  • Python cryptography library
pip install cryptography

Trigger the skill with natural requests

Agents load a skill when your request matches its description, so you can simply describe the outcome. Mention the concrete thing you want: a root CA, an intermediate CA, a server certificate, a CRL, or OCSP settings. Naming the lab or staging context helps the agent stay within the skill's scope.

Requests that match the skill's description include standing up an internal CA, issuing or revoking X.509 certificates, and designing a PKI trust hierarchy for TLS, code signing or client authentication.

  • Set up a two-tier internal CA for a lab: an offline root and an intermediate that issues certificates.
  • Walk me through creating a server certificate from my intermediate CA and explain each extension.
  • Generate a CRL for my test intermediate CA and show how a revoked certificate appears in it.
  • Explain how path length constraints limit what my intermediate CA can sign.

Work through a typical build

A useful session follows the hierarchy top-down. The agent sets up the Root CA, then the Intermediate CA signed by it, then issues leaf certificates. The skill's validation checklist gives you concrete things to verify: the Root CA self-signed certificate is valid, the Intermediate chains to the Root, issued certificates chain to Intermediate and then Root, path length constraints are enforced, the CRL is generated and accessible, revoked certificates appear in the CRL, and certificate policies are embedded.

The skill's template describes a directory layout with separate private, certs, crl and issued folders for each CA, which gives you a clear structure to review.

  • Root CA: self-signed certificate, kept offline in principle
  • Intermediate CA: signed by the Root, used for day-to-day issuance
  • Leaf certificates: server, client and code signing, issued by the Intermediate
  • Revocation: CRL distribution points and OCSP settings

Safety notes: scripts, keys and production use

The bundled scripts write private keys to disk. Treat the output directory as sensitive, keep it out of version control, and do not reuse lab keys elsewhere. The skill's guidance says the root key should be offline and HSM-protected, but this is described rather than enforced by the scripts.

Do not use this output as a production trust root without independent review and a proper key ceremony and tooling. A private CA is not trusted by browsers, so it cannot issue certificates for public websites; those must come from a publicly trusted CA. The skill's security notes recommend at least 4096-bit RSA or P-384 ECDSA for CA keys, path length constraints on intermediates, certificate policy OIDs, CRL and OCSP enabled, and auditing of all issuance.

  • Scripts write private keys to disk: use a disposable lab directory
  • Offline, HSM-protected root keys are guidance only, not enforced
  • Not suitable for public websites
  • Recommended key strength: 4096-bit RSA or P-384 ECDSA

What people use it for

  • Building a two-tier internal CA in a lab to learn how certificate chains are formed.
  • Issuing test server and client certificates from an intermediate CA for an internal app in staging.
  • Demonstrating how a revoked certificate appears in a CRL during a security training session.
  • Reviewing how a proposed CA hierarchy should be structured, including extensions and path length limits.
  • Documenting certificate policies and revocation settings for a security architecture review.

Frequently asked questions

Is the Configuring a Certificate Authority with OpenSSL skill free?

The skill is licensed under Apache-2.0, as listed on this page. Check the license file in the ZIP for the full terms before you reuse or redistribute it.

What do I need to install before using this skill?

You need Python 3.8 or newer and the Python cryptography library, installed with pip install cryptography. The skill's scripts use this library, so a separate OpenSSL install is not required by the listing.

Where do I put the skill folder?

Unzip the downloaded ZIP into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder to limit it to one project. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills.

Can I use this to issue certificates for my public website?

No. A private CA is not trusted by browsers, so public website certificates must come from a publicly trusted CA. This skill is aimed at internal, lab and staging use.

Does the skill use the network?

According to its listing, the skill does not use the network, but it does run scripts. Review the scripts before running them, since they write private keys to disk.

Can I use this for a production certificate authority?

Not without review. The scripts write private keys to disk, and the offline, HSM-protected root key guidance is described rather than enforced, so a production CA needs a proper key ceremony and tooling.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits engineers building or testing an internal PKI in a lab, students learning how X.509 chains, extensions and revocation work, and security teams documenting a CA design. It is not a substitute for production key management or for a publicly trusted CA, so pick a dedicated HSM-backed PKI product or a managed CA service for production trust roots.

Download the skill